| CVE-2026-87785 |
Authentication bypass by spoofing vulnerability in Apache Syncope
|
Non notée
|
14 sept. 2026 |
| CVE-2026-87802 |
Improper verification of cryptographic signature vulnerability in Apache Syncope
|
Non notée
|
14 sept. 2026 |
| CVE-2026-62418 |
Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and…
|
Non notée
|
20 juil. 2026 |
| CVE-2026-62183 |
Improper Privilege Management vulnerability in Apache Syncope
|
Non notée
|
20 juil. 2026 |
| CVE-2026-57308 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope
|
Non notée
|
20 juil. 2026 |
| CVE-2026-53421 |
Improper Isolation or Compartmentalization vulnerability in Apache Syncope
|
Non notée
|
20 juil. 2026 |
| CVE-2026-53405 |
Improper Isolation or Compartmentalization vulnerability in Apache Syncope
|
Non notée
|
20 juil. 2026 |
| CVE-2026-63071 |
Improper Isolation or Compartmentalization vulnerability in Apache Syncope
|
Non notée
|
20 juil. 2026 |
| CVE-2026-42797 |
Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope
|
Non notée
|
25 mai 2026 |
| CVE-2026-42782 |
Improper Isolation or Compartmentalization vulnerability in Apache Syncope
|
Non notée
|
25 mai 2026 |
| CVE-2026-23794 |
Reflected XSS in Apache Syncope's Enduser Login page
|
Non notée
|
3 févr. 2026 |
| CVE-2026-23795 |
Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console
|
Non notée
|
3 févr. 2026 |
| CVE-2025-65998 |
Apache Syncope can be configured to store the user password values in the internal database with AES encryption,…
|
Non notée
|
24 nov. 2025 |
| CVE-2025-57738 |
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide…
|
Non notée
|
20 oct. 2025 |
| CVE-2024-45031 |
When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization
|
Non notée
|
24 oct. 2024 |
| CVE-2024-38503 |
When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could…
|
Non notée
|
22 juil. 2024 |
| CVE-2018-17186 |
An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not…
|
Non notée
|
6 nov. 2018 |
| CVE-2018-17184 |
A malicious user with enough administration entitlements can inject html-like elements containing JavaScript…
|
Non notée
|
6 nov. 2018 |
| CVE-2018-1322 |
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and…
|
Non notée
|
20 mars 2018 |
| CVE-2018-1321 |
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and…
|
Non notée
|
20 mars 2018 |